codehere 0.1.1 → 0.2.1

package/dist/infrastructure/security/input-validator.js

@@ -41,132 +41,8 @@ export function validateFilePath(filepath) {
         sanitized: errors.length > 0 ? sanitized : undefined,
     };
 }
-/**
- * Comprehensive prompt injection detection
- * Detects: instruction injection, role-playing, jailbreaks, context manipulation, etc.
- */
-export function detectPromptInjection(input) {
-    const lower = input.toLowerCase();
-    // Skip validation for known system prompts (to avoid false positives)
-    // System prompts typically start with "You are a [Role] for" or similar patterns
-    const isSystemPrompt = /^you are (?:a|an) [a-z]+ (?:agent|assistant|system|service)/i.test(input.trim());
-    if (isSystemPrompt) {
-        return null; // Don't flag system-generated prompts
-    }
-    // Critical: Direct instruction override attempts
-    const criticalPatterns = [
-        {
-            pattern: /(?:ignore|forget|disregard|override).*(?:previous|above|earlier|instructions|system|prompt)/i,
-            category: 'Instruction Override',
-            description: 'Attempt to override system instructions',
-        },
-        {
-            // More specific: must have explicit role manipulation intent
-            // Exclude legitimate system prompts - now handled by isSystemPrompt check above
-            pattern: /(?:you are|act as|pretend to be|roleplay as)\s+(?:an?\s+)?(?:admin|root|system|developer|assistant|ai|hacker|malicious|evil)/i,
-            category: 'Role-Playing Attack',
-            description: 'Attempt to manipulate AI role/identity',
-        },
-        {
-            pattern: /(?:system|assistant|user):\s*(?:ignore|forget|new instructions|override)/i,
-            category: 'Context Manipulation',
-            description: 'Attempt to manipulate conversation context',
-        },
-        {
-            pattern: /(?:jailbreak|danie|ignore all|new instructions|override safety)/i,
-            category: 'Jailbreak Attempt',
-            description: 'Known jailbreak pattern detected',
-        },
-        {
-            pattern: /(?:<\|im_start\||\[INST\]|###|---).*(?:system|assistant|user).*(?:ignore|override|new)/i,
-            category: 'Format Injection',
-            description: 'Attempt to inject format tokens',
-        },
-    ];
-    // High: Indirect manipulation attempts
-    const highPatterns = [
-        {
-            pattern: /(?:tell me|show me|reveal|expose|leak).*(?:prompt|instructions|system|secret|api key|password)/i,
-            category: 'Information Extraction',
-            description: 'Attempt to extract sensitive information',
-        },
-        {
-            pattern: /(?:repeat|echo|say back).*(?:everything|all|entire).*(?:above|previous|prompt)/i,
-            category: 'Prompt Extraction',
-            description: 'Attempt to extract full prompt',
-        },
-        {
-            pattern: /(?:translate|convert|rewrite).*(?:to|as).*(?:base64|hex|binary|code)/i,
-            category: 'Encoding Bypass',
-            description: 'Attempt to bypass filters via encoding',
-        },
-        {
-            // More specific: only match direct execution requests, not security analysis mentions
-            // Exclude patterns like "analyze code execution" or "code execution vulnerabilities"
-            pattern: /(?:please|can you|will you|I want you to|you should|you must).*(?:execute|run|eval|exec).*(?:code|command|script|function|this)/i,
-            category: 'Code Execution Request',
-            description: 'Request for code execution',
-        },
-    ];
-    // Medium: Suspicious patterns
-    const mediumPatterns = [
-        {
-            pattern: /(?:what are|what is).*(?:your|the).*(?:instructions|prompt|system message)/i,
-            category: 'Prompt Probing',
-            description: 'Probing for system instructions',
-        },
-        {
-            pattern: /(?:hypothetical|imagine|suppose|what if).*(?:you could|you were|you had)/i,
-            category: 'Hypothetical Manipulation',
-            description: 'Hypothetical scenario manipulation',
-        },
-        {
-            pattern: /(?:this is|that was).*(?:test|example|practice|drill)/i,
-            category: 'Test Bypass',
-            description: 'Attempt to bypass restrictions via "test" framing',
-        },
-    ];
-    // Check critical patterns first
-    for (const { pattern, category, description } of criticalPatterns) {
-        if (pattern.test(input)) {
-            return {
-                detected: true,
-                severity: 'critical',
-                category,
-                pattern: pattern.toString(),
-                description,
-            };
-        }
-    }
-    // Check high severity patterns
-    for (const { pattern, category, description } of highPatterns) {
-        if (pattern.test(input)) {
-            return {
-                detected: true,
-                severity: 'high',
-                category,
-                pattern: pattern.toString(),
-                description,
-            };
-        }
-    }
-    // Check medium severity patterns
-    for (const { pattern, category, description } of mediumPatterns) {
-        if (pattern.test(input)) {
-            return {
-                detected: true,
-                severity: 'medium',
-                category,
-                pattern: pattern.toString(),
-                description,
-            };
-        }
-    }
-    return null;
-}
 /**
  * Validate query string to prevent injection
- * Enhanced with prompt injection detection
  */
 export function validateQuery(query) {
     const errors = [];
@@ -174,13 +50,6 @@ export function validateQuery(query) {
     if (query.includes('\0')) {
         errors.push('Null bytes not allowed in query');
     }
-    // Check for prompt injection
-    const injectionResult = detectPromptInjection(query);
-    if (injectionResult) {
-        if (injectionResult.severity === 'critical' || injectionResult.severity === 'high') {
-            errors.push(`Prompt injection detected (${injectionResult.severity}): ${injectionResult.description}`);
-        }
-    }
     // Check for command injection patterns
     const commandInjectionPatterns = [
         /[;&|`$(){}[\]]/, // Shell metacharacters
@@ -194,20 +63,13 @@ export function validateQuery(query) {
             break;
         }
     }
-    // Sanitize query (only if not critical prompt injection)
-    let sanitized = query;
-    if (!injectionResult || injectionResult.severity !== 'critical') {
-        sanitized = query
-            .replace(/\0/g, '') // Remove null bytes
-            .replace(/[;&|`$(){}[\]]/g, '') // Remove shell metacharacters
-            .replace(/<script/gi, '&lt;script') // Escape script tags
-            .replace(/javascript:/gi, '') // Remove javascript protocol
-            .replace(/on\w+\s*=/gi, ''); // Remove event handlers
-    }
-    else {
-        // For critical prompt injection, don't sanitize - reject entirely
-        sanitized = '';
-    }
+    // Sanitize query
+    let sanitized = query
+        .replace(/\0/g, '') // Remove null bytes
+        .replace(/[;&|`$(){}[\]]/g, '') // Remove shell metacharacters
+        .replace(/<script/gi, '&lt;script') // Escape script tags
+        .replace(/javascript:/gi, '') // Remove javascript protocol
+        .replace(/on\w+\s*=/gi, ''); // Remove event handlers
     // Trim and limit length
     sanitized = sanitized.trim();
     const MAX_QUERY_LENGTH = 10000; // Reasonable limit
@@ -218,7 +80,7 @@ export function validateQuery(query) {
     return {
         valid: errors.length === 0,
         errors,
-        sanitized: errors.length > 0 && sanitized.length > 0 ? sanitized : undefined,
+        sanitized: errors.length > 0 ? sanitized : undefined,
     };
 }
 /**
@@ -266,4 +128,25 @@ export function validateFileContent(content, maxSize = 10 * 1024 * 1024) {
         errors,
     };
 }
+/**
+ * Sanitize user input for logging (prevent sensitive data leakage)
+ */
+export function sanitizeForLogging(input) {
+    // Remove potential secrets (API keys, tokens, etc.)
+    let sanitized = input
+        // Remove API keys (Cohere format: alphanumeric, 40+ chars)
+        .replace(/[A-Za-z0-9]{40,}/g, '[REDACTED]')
+        // Remove email addresses
+        .replace(/[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g, '[EMAIL_REDACTED]')
+        // Remove potential tokens
+        .replace(/token[=:]\s*[A-Za-z0-9_-]+/gi, 'token=[REDACTED]')
+        .replace(/password[=:]\s*[^\s]+/gi, 'password=[REDACTED]')
+        .replace(/secret[=:]\s*[^\s]+/gi, 'secret=[REDACTED]');
+    // Limit length for logging
+    const MAX_LOG_LENGTH = 1000;
+    if (sanitized.length > MAX_LOG_LENGTH) {
+        sanitized = sanitized.substring(0, MAX_LOG_LENGTH) + '...[TRUNCATED]';
+    }
+    return sanitized;
+}
 //# sourceMappingURL=input-validator.js.map

package/dist/infrastructure/security/trust-scorer.js

@@ -0,0 +1,337 @@
+/**
+ * Shared trust scoring engine — used by CLI, MCP server, and hook handler.
+ *
+ * Three scanning passes:
+ *   Pass 1 (comments+regex stripped): Secrets & API keys — string literals visible, comments/regex stripped
+ *   Pass 2 (fully stripped):          Structural patterns — eval, execSync, innerHTML, etc.
+ *                                     Stripped to avoid false positives from pattern definitions
+ *   Pass 3 (instruction scan):        Hook-layer patterns on fully stripped code
+ *
+ * All passes run locally, zero API calls.
+ */
+import { scanPayload } from '../hooks/claude-sdk-hook.js';
+export const CODE_PATTERNS = [
+    // Secrets (scan with strings visible — must see inside string literals)
+    { regex: /(?:password|passwd|pass|pwd|secret|api_?key|auth_?token)\s*[:=]\s*['"`][^'"`\s]{4,}['"`]/gi, severity: 'high', category: 'Secrets', description: 'Hardcoded credential', cwe: 'CWE-798', scanRaw: true },
+    { regex: /(?:password|passwd|secret|api.?key|auth.?token)[^\n]*\|\|\s*['"`][^'"`\s]{3,}['"`]/gi, severity: 'high', category: 'Secrets', description: 'Hardcoded fallback credential (env var || literal)', cwe: 'CWE-798', scanRaw: true },
+    { regex: /sk-[a-zA-Z0-9]{32,}|xoxb-[a-zA-Z0-9-]+|ghp_[a-zA-Z0-9]{36,}/i, severity: 'critical', category: 'Secrets', description: 'API key pattern (OpenAI/Slack/GitHub)', cwe: 'CWE-798', scanRaw: true },
+    // SQL Injection (scan with strings visible — SQL lives inside string literals)
+    // Per-quote-type to allow inner quotes: "SELECT...WHERE name='" + user
+    { regex: /"[^"]*SELECT[^"]*FROM[^"]*WHERE[^"]*"\s*\+/gi, severity: 'critical', category: 'SQL Injection', description: 'SQL query built with string concatenation (double-quoted)', cwe: 'CWE-89', scanRaw: true },
+    { regex: /'[^']*SELECT[^']*FROM[^']*WHERE[^']*'\s*\+/gi, severity: 'critical', category: 'SQL Injection', description: 'SQL query built with string concatenation (single-quoted)', cwe: 'CWE-89', scanRaw: true },
+    { regex: /query\s*\(\s*['"`][^'"`]*\$\{|execute\s*\([`'"]\s*SELECT.*\$\{/gi, severity: 'critical', category: 'SQL Injection', description: 'String interpolation in SQL query', cwe: 'CWE-89', scanRaw: true },
+    { regex: /pool\.query\s*\([^,)]*\+[^,)]*\)/g, severity: 'high', category: 'SQL Injection', description: 'String concatenation in SQL query call', cwe: 'CWE-89' },
+    // Command injection with user input (scan with strings visible)
+    // Catches require('child_process').execSync(req.body.cmd) — child_process is in a string
+    // but the method call and req. reference are in plain code
+    { regex: /\.exec(?:Sync)?\s*\(\s*req\./gi, severity: 'critical', category: 'Command Injection', description: 'exec/execSync called directly with request input', cwe: 'CWE-78', scanRaw: true },
+    // Injection (scan fully stripped — structural, must not trigger on pattern defs or comments)
+    { regex: /\beval\s*\(/g, severity: 'critical', category: 'Code Injection', description: 'eval() allows arbitrary code execution', cwe: 'CWE-95' },
+    { regex: /new\s+Function\s*\(/g, severity: 'critical', category: 'Code Injection', description: 'Function() constructor execution', cwe: 'CWE-95' },
+    { regex: /child_process\.exec(?:Sync)?\s*\(\s*[^,)'"]*(?:req\.|body\.|params\.|query\.)/g, severity: 'critical', category: 'Command Injection', description: 'execSync/exec with user-controlled input', cwe: 'CWE-78' },
+    { regex: /child_process\.exec\s*\(\s*[^,)]*\+/g, severity: 'critical', category: 'Command Injection', description: 'Command injection via string concat', cwe: 'CWE-78' },
+    // Destructured exec/execSync with string concat containing user input
+    { regex: /\bexec(?:Sync)?\s*\([^)]*\+\s*req\./g, severity: 'critical', category: 'Command Injection', description: 'exec() with string concatenation of user input', cwe: 'CWE-78', scanRaw: true },
+    { regex: /\.innerHTML\s*=\s*[^=]/g, severity: 'high', category: 'XSS', description: 'innerHTML assignment (potential XSS)', cwe: 'CWE-79' },
+    { regex: /document\.write\s*\(/g, severity: 'high', category: 'XSS', description: 'document.write can lead to XSS', cwe: 'CWE-79' },
+    // Insecure deserialization
+    { regex: /JSON\.parse\s*\([^)]*req\.|JSON\.parse\s*\([^)]*input/gi, severity: 'medium', category: 'Insecure Input', description: 'JSON.parse on unvalidated user input', cwe: 'CWE-502' },
+    { regex: /yaml\.load\s*\([^)]*\)/g, severity: 'high', category: 'Insecure Deserialization', description: 'yaml.load without safeLoad', cwe: 'CWE-502' },
+    { regex: /pickle\.loads\s*\(/g, severity: 'critical', category: 'Insecure Deserialization', description: 'pickle.loads on arbitrary data', cwe: 'CWE-502' },
+    // Auth issues
+    { regex: /jwt\.verify\s*\([^,)]+,\s*[^,)]+,\s*\{\s*algorithms\s*:\s*\[\s*['"`]none['"`]/i, severity: 'critical', category: 'Auth Bypass', description: 'JWT algorithm:none vulnerability', cwe: 'CWE-347' },
+    { regex: /password\s*===?\s*['"`]|password\s*==\s*req\./gi, severity: 'high', category: 'Auth Bypass', description: 'Plaintext password comparison', cwe: 'CWE-256' },
+    // Weak crypto
+    { regex: /Math\.random\s*\(\s*\).*(?:token|key|secret|password|nonce|salt)/gi, severity: 'high', category: 'Weak Crypto', description: 'Math.random() for security-sensitive value', cwe: 'CWE-338' },
+    { regex: /createCipheriv\s*\([^,]*['"`](?:des|rc4|md5)[^'"]*['"`]/gi, severity: 'high', category: 'Weak Crypto', description: 'Weak/deprecated cipher algorithm', cwe: 'CWE-327' },
+    // Path traversal
+    { regex: /readFile\s*\([^)]*req\.|readFileSync\s*\([^)]*user/gi, severity: 'high', category: 'Path Traversal', description: 'File read with user-controlled path', cwe: 'CWE-22' },
+    { regex: /__dirname\s*\+\s*['"`/]*\s*\+?\s*req\.(params|query|body)/gi, severity: 'high', category: 'Path Traversal', description: 'Path built from user input without sanitization', cwe: 'CWE-22' },
+    { regex: /sendFile\s*\([^)]*req\.(params|query|body)/gi, severity: 'high', category: 'Path Traversal', description: 'sendFile with user-controlled path', cwe: 'CWE-22' },
+    // Open redirect
+    { regex: /res\.redirect\s*\([^)]*req\.(query|body|params)/gi, severity: 'medium', category: 'Open Redirect', description: 'Redirect to user-controlled URL', cwe: 'CWE-601' },
+    // Server-side XSS (template injection in response)
+    { regex: /res\.send\s*\(\s*`[^`]*\$\{[^}]*req\.(query|body|params)/gi, severity: 'high', category: 'XSS', description: 'User input interpolated directly into response HTML', cwe: 'CWE-79', scanRaw: true },
+    { regex: /res\.send\s*\([^)]*\+\s*req\.(query|body|params)/gi, severity: 'high', category: 'XSS', description: 'User input concatenated into response', cwe: 'CWE-79', scanRaw: true },
+    // Command injection via variable indirection (exec with non-literal arg)
+    { regex: /\.exec\s*\(\s*(?!['"`])(\w+)\s*[,)]/g, severity: 'high', category: 'Command Injection', description: 'exec() called with variable argument — verify input is not user-controlled', cwe: 'CWE-78' },
+    // SSRF
+    { regex: /fetch\s*\(\s*req\.(body|query|params)/gi, severity: 'high', category: 'SSRF', description: 'Server-side request to user-controlled URL', cwe: 'CWE-918' },
+    { regex: /axios\s*\.\s*(?:get|post|put|delete)\s*\(\s*req\.(body|query|params)/gi, severity: 'high', category: 'SSRF', description: 'HTTP request to user-controlled URL', cwe: 'CWE-918' },
+    // Weak crypto (MD5, SHA1 for passwords)
+    { regex: /createHash\s*\(\s*['"`]md5['"`]\s*\)/gi, severity: 'high', category: 'Weak Crypto', description: 'MD5 hash is cryptographically broken — use bcrypt/argon2 for passwords', cwe: 'CWE-328', scanRaw: true },
+    { regex: /createHash\s*\(\s*['"`]sha1['"`]\s*\)/gi, severity: 'medium', category: 'Weak Crypto', description: 'SHA1 is deprecated for security use — use SHA-256+ or bcrypt', cwe: 'CWE-328', scanRaw: true },
+    // JWT algorithm:none (both sign and verify — scan raw to catch string content)
+    { regex: /jwt\.(?:sign|verify)\s*\([^)]*algorithm\s*:\s*['"`]none['"`]/gi, severity: 'critical', category: 'Auth Bypass', description: 'JWT with algorithm "none" disables signature verification', cwe: 'CWE-347', scanRaw: true },
+];
+export function measureComplexity(code) {
+    const lines = code.split('\n').length;
+    const functionMatches = code.match(/\b(function\s+\w+|=>\s*\{|\basync\s+function|\bclass\s+\w+)/g);
+    const functions = functionMatches?.length ?? 0;
+    const branchKeywords = code.match(/\b(if|else\s+if|while|for|switch|case|catch|\?\s*:)/g);
+    const cyclomaticEstimate = (branchKeywords?.length ?? 0) + 1;
+    let depth = 0, maxDepth = 0;
+    for (const char of code) {
+        if (char === '{') {
+            depth++;
+            maxDepth = Math.max(maxDepth, depth);
+        }
+        if (char === '}')
+            depth = Math.max(0, depth - 1);
+    }
+    const todos = (code.match(/\/\/\s*(TODO|FIXME|HACK|XXX)/gi) ?? []).length;
+    return { lines, functions, nestingDepth: maxDepth, cyclomaticEstimate, todos };
+}
+// ── Scoring ───────────────────────────────────────────────────────────────────
+const SEVERITY_PENALTY = {
+    critical: 25,
+    high: 12,
+    medium: 5,
+    low: 2,
+};
+/**
+ * Returns true if the character at position `pos` follows an expression-start
+ * context (i.e., `/` here opens a regex literal, not a division operator).
+ */
+function isRegexStart(code, pos) {
+    let j = pos - 1;
+    while (j >= 0 && (code[j] === ' ' || code[j] === '\t'))
+        j--;
+    if (j < 0)
+        return true;
+    const prev = code[j];
+    return '=([{,;!&|?:~^%+->'.includes(prev) ||
+        /\b(return|typeof|instanceof|in|new|delete|void|throw|case)\s*$/.test(code.slice(0, pos).trimEnd());
+}
+/**
+ * Strip ONLY comments and regex literals — string literals remain visible.
+ * Used for pass 1 (raw pattern scanning): we need to see inside string literals to find
+ * hardcoded secrets and SQL injection, but comments/regex literals that contain
+ * example patterns would otherwise cause false positives.
+ */
+function stripCommentsAndRegex(code) {
+    const out = [];
+    let i = 0;
+    const len = code.length;
+    while (i < len) {
+        const ch = code[i];
+        const next = code[i + 1];
+        // Single-line comment: // ...
+        if (ch === '/' && next === '/') {
+            const start = i;
+            while (i < len && code[i] !== '\n')
+                i++;
+            out.push(' '.repeat(i - start));
+            continue;
+        }
+        // Block comment: /* ... */
+        if (ch === '/' && next === '*') {
+            const start = i;
+            i += 2;
+            while (i < len && !(code[i - 1] === '*' && code[i] === '/'))
+                i++;
+            i++;
+            out.push(' '.repeat(i - start));
+            continue;
+        }
+        // Regex literal: /.../ — strip to avoid pattern-def false positives
+        if (ch === '/' && next !== '/' && next !== '*' && isRegexStart(code, i)) {
+            const start = i;
+            i++;
+            while (i < len && code[i] !== '/' && code[i] !== '\n') {
+                if (code[i] === '\\')
+                    i++;
+                if (code[i] === '[') {
+                    i++;
+                    while (i < len && code[i] !== ']') {
+                        if (code[i] === '\\')
+                            i++;
+                        i++;
+                    }
+                }
+                i++;
+            }
+            i++;
+            while (i < len && 'gimsuy'.includes(code[i]))
+                i++;
+            out.push(' '.repeat(i - start));
+            continue;
+        }
+        // String literals — pass through (needed to detect secrets/SQL inside them)
+        out.push(ch);
+        i++;
+    }
+    return out.join('');
+}
+/**
+ * Fully strip all string literals, regex literals, and comments.
+ * Used for pass 2 (structural pattern scanning) to avoid false positives
+ * from pattern definitions, example code in strings, etc.
+ */
+function stripLiterals(code) {
+    const out = [];
+    let i = 0;
+    const len = code.length;
+    while (i < len) {
+        const ch = code[i];
+        const next = code[i + 1];
+        if (ch === '/' && next === '/') {
+            const start = i;
+            while (i < len && code[i] !== '\n')
+                i++;
+            out.push(' '.repeat(i - start));
+            continue;
+        }
+        if (ch === '/' && next === '*') {
+            const start = i;
+            i += 2;
+            while (i < len && !(code[i - 1] === '*' && code[i] === '/'))
+                i++;
+            i++;
+            out.push(' '.repeat(i - start));
+            continue;
+        }
+        if (ch === '/' && next !== '/' && next !== '*' && isRegexStart(code, i)) {
+            const start = i;
+            i++;
+            while (i < len && code[i] !== '/' && code[i] !== '\n') {
+                if (code[i] === '\\')
+                    i++;
+                if (code[i] === '[') {
+                    i++;
+                    while (i < len && code[i] !== ']') {
+                        if (code[i] === '\\')
+                            i++;
+                        i++;
+                    }
+                }
+                i++;
+            }
+            i++;
+            while (i < len && 'gimsuy'.includes(code[i]))
+                i++;
+            out.push(' '.repeat(i - start));
+            continue;
+        }
+        if (ch === '`') {
+            const start = i;
+            i++;
+            while (i < len && code[i] !== '`') {
+                if (code[i] === '\\')
+                    i++;
+                i++;
+            }
+            i++;
+            out.push(' '.repeat(i - start));
+            continue;
+        }
+        if (ch === '"') {
+            const start = i;
+            i++;
+            while (i < len && code[i] !== '"' && code[i] !== '\n') {
+                if (code[i] === '\\')
+                    i++;
+                i++;
+            }
+            i++;
+            out.push(' '.repeat(i - start));
+            continue;
+        }
+        if (ch === "'") {
+            const start = i;
+            i++;
+            while (i < len && code[i] !== "'" && code[i] !== '\n') {
+                if (code[i] === '\\')
+                    i++;
+                i++;
+            }
+            i++;
+            out.push(' '.repeat(i - start));
+            continue;
+        }
+        out.push(ch);
+        i++;
+    }
+    return out.join('');
+}
+export function scoreFile(filepath, code) {
+    const allFindings = [];
+    // Pass 1: Comments+regex stripped but strings visible — catches secrets/SQL inside literals
+    const rawForSecrets = stripCommentsAndRegex(code);
+    for (const pattern of CODE_PATTERNS.filter(p => p.scanRaw)) {
+        let match;
+        const re = new RegExp(pattern.regex.source, pattern.regex.flags);
+        while ((match = re.exec(rawForSecrets)) !== null) {
+            const line = code.substring(0, match.index).split('\n').length;
+            allFindings.push({
+                severity: pattern.severity,
+                category: pattern.category,
+                description: pattern.description,
+                line,
+                cwe: pattern.cwe,
+                matched: match[0].substring(0, 80),
+            });
+            if (!re.global)
+                break;
+        }
+    }
+    // Pass 2: Fully stripped code — structural patterns (no false positives from literals)
+    const scannable = stripLiterals(code);
+    for (const pattern of CODE_PATTERNS.filter(p => !p.scanRaw)) {
+        let match;
+        const re = new RegExp(pattern.regex.source, pattern.regex.flags);
+        while ((match = re.exec(scannable)) !== null) {
+            const line = code.substring(0, match.index).split('\n').length;
+            allFindings.push({
+                severity: pattern.severity,
+                category: pattern.category,
+                description: pattern.description,
+                line,
+                cwe: pattern.cwe,
+            });
+            if (!re.global)
+                break;
+        }
+    }
+    // Pass 3: Hook-layer instruction patterns on fully stripped code
+    const instructionFindings = scanPayload(scannable);
+    for (const f of instructionFindings) {
+        const isDupe = allFindings.some(af => af.category === f.category && af.description === f.description);
+        if (!isDupe) {
+            allFindings.push({
+                severity: f.severity,
+                category: f.category,
+                description: f.description,
+                matched: f.matched,
+            });
+        }
+    }
+    const complexity = measureComplexity(code);
+    let penalty = 0;
+    for (const f of allFindings)
+        penalty += SEVERITY_PENALTY[f.severity] ?? 2;
+    if (complexity.cyclomaticEstimate > 20)
+        penalty += 5;
+    if (complexity.cyclomaticEstimate > 50)
+        penalty += 10;
+    if (complexity.nestingDepth > 6)
+        penalty += 5;
+    if (complexity.todos > 5)
+        penalty += 3;
+    const score = Math.max(0, Math.min(100, 100 - penalty));
+    const grade = score >= 90 ? 'A' : score >= 75 ? 'B' : score >= 60 ? 'C' : score >= 40 ? 'D' : 'F';
+    const critical = allFindings.filter(f => f.severity === 'critical').length;
+    const high = allFindings.filter(f => f.severity === 'high').length;
+    const summary = critical > 0
+        ? `${critical} critical issue${critical > 1 ? 's' : ''} require immediate attention`
+        : high > 0
+            ? `${high} high-severity issue${high > 1 ? 's' : ''} should be addressed before merge`
+            : allFindings.length === 0
+                ? 'No issues found — clean scan'
+                : `${allFindings.length} minor issue${allFindings.length > 1 ? 's' : ''} found`;
+    return { filepath, score, grade, findings: allFindings, complexity, summary };
+}
+export function gradeFromScore(score) {
+    return score >= 90 ? 'A' : score >= 75 ? 'B' : score >= 60 ? 'C' : score >= 40 ? 'D' : 'F';
+}
+//# sourceMappingURL=trust-scorer.js.map

package/dist/infrastructure/storage/embeddings-path.js

@@ -5,7 +5,6 @@
 import { join } from 'path';
 import { existsSync, mkdirSync } from 'fs';
 import { findCodebaseRoot } from '../../domain/services/codebase-detector.js';
-import { getConfigManager } from '../config/config-manager.js';
 /**
  * Get embeddings database path for a specific codebase
  * Uses codebase root detection to ensure per-repo isolation
@@ -14,34 +13,25 @@ import { getConfigManager } from '../config/config-manager.js';
  * @returns Object with root path, database path, and cache directory
  */
 export function getEmbeddingsDbPath(cwd = process.cwd()) {
-    const config = getConfigManager();
     const codebaseInfo = findCodebaseRoot(cwd);
     if (!codebaseInfo) {
         // Fallback to cwd if codebase root can't be determined
         const root = cwd;
-        const cacheDir = config.getCacheDir(root);
-        const embeddingsDir = config.getEmbeddingsDir(root);
-        const dbPath = join(embeddingsDir, 'embeddings.sqlite');
+        const dbPath = join(root, '.codehere-cache', 'embeddings.sqlite');
+        const cacheDir = join(root, '.codehere-cache');
         // Ensure cache directory exists
         if (!existsSync(cacheDir)) {
             mkdirSync(cacheDir, { recursive: true });
         }
-        if (!existsSync(embeddingsDir)) {
-            mkdirSync(embeddingsDir, { recursive: true });
-        }
         return { root, dbPath, cacheDir };
     }
     const root = codebaseInfo.rootPath;
-    const cacheDir = config.getCacheDir(root);
-    const embeddingsDir = config.getEmbeddingsDir(root);
-    const dbPath = join(embeddingsDir, 'embeddings.sqlite');
+    const dbPath = join(root, '.codehere-cache', 'embeddings.sqlite');
+    const cacheDir = join(root, '.codehere-cache');
     // Ensure cache directory exists
     if (!existsSync(cacheDir)) {
         mkdirSync(cacheDir, { recursive: true });
     }
-    if (!existsSync(embeddingsDir)) {
-        mkdirSync(embeddingsDir, { recursive: true });
-    }
     return { root, dbPath, cacheDir };
 }
 //# sourceMappingURL=embeddings-path.js.map

package/dist/infrastructure/storage/plan-repository.js

@@ -8,13 +8,14 @@ import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'fs';
 import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';
 import { randomUUID } from 'crypto';
-import { getConfigManager } from '../config/config-manager.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 function getPlansDir() {
-    const config = getConfigManager();
-    const dataDir = config.getDataDir();
-    return join(dataDir, 'plans');
+    const agentDir = join(__dirname, '../../..');
+    if (existsSync(join(agentDir, 'package.json'))) {
+        return join(agentDir, 'data', 'plans');
+    }
+    return join(process.cwd(), '.codehere', 'plans');
 }
 export class FilePlanRepository {
     plansDir;

package/dist/infrastructure/storage/sqlite-decision-repository.js

@@ -7,13 +7,17 @@
  */
 import { readFileSync, existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
 import initSqlJs from 'sql.js';
 import { randomUUID } from 'crypto';
-import { getConfigManager } from '../config/config-manager.js';
 function getDbPath() {
-    const config = getConfigManager();
-    const dataDir = config.getDataDir();
-    return join(dataDir, 'decisions.sqlite');
+    const __filename = fileURLToPath(import.meta.url);
+    const __dirname = dirname(__filename);
+    const agentDir = join(__dirname, '../../..');
+    if (existsSync(join(agentDir, 'package.json'))) {
+        return join(agentDir, 'data', 'decisions.sqlite');
+    }
+    return join(process.cwd(), 'agent', 'data', 'decisions.sqlite');
 }
 export class SQLiteDecisionRepository {
     dbPath;